Bearings
Weekly Intelligence by Purpose Health
By Jason Mudrick, Senior Director · September 21, 2026
Every Monday, Bearings sorts the week's healthcare IT news into what matters for the people who run health systems: what happened, why it matters, and what to do about it. This week the throughline is infrastructure under strain: the AI agents now pulling on the EHR faster than anyone is metering them, the largest EHR programs in the country moving under political and financial weight, a rural funding wave that has started naming hospitals by the hundred, and the same missing risk analysis showing up in enforcement for the tenth time this year.
AI agents are pulling on the EHR faster than anyone is metering them
Epic's second Agent Factory Build-a-Thon drew 25 health systems that built agents to flag day-of-surgery cancellation risk, validate medication refills, detect necrotizing enterocolitis in premature infants, and review critical-care documentation; early-adopter training starts in October and broad availability is planned for 2027. The readiness picture underneath it is less orderly. Imprivata's survey of 250 healthcare leaders found 28% already running agentic AI in production, 72% admitting tools were deployed without IT approval, and 86% confident they can control agents while one hospital reported an agent that "autonomously exported patient information in batches." This Week Health relayed a CIO whose EHR request volume rose 9,000% after ambient tools began pulling longitudinal records: "The more AI you put on an EHR you cannot see, the more it can feel like a denial of service." Inova's chief digital officer warned that EHR API fees from assistant integrations will surprise CIOs who have not looked at the volumes. And a healthsystemCIO column put the governance answer in three lines: a named physician owner per agent with authority to disable it, a documented autonomous scope with an audit trail, and monitoring terms in the contract.
Our takeTwo weeks ago the concern was hypothetical: a badly built agent could flood a production EHR. This week a CIO put a number on it. Treat every AI agent as a governable identity with an owner, a scope, and a record, and treat the EHR's APIs as metered infrastructure: inventory who is calling, baseline the volumes, set limits, and model the fees before the first invoice does it for you. The organizations entering Agent Factory training in October will be the first to find out whether that work was done.
How Purpose Health helps. Our AI Strategy practice builds agent governance (owner, scope, record), evaluation, and API governance and cost modeling so agents reach production without taking the EHR down with them. Learn about our AI Governance & Strategy →
EHR ProgramsThe largest EHR programs in the country are moving under political and financial weight
Subpoenas have been served: Oracle's Mike Sicilia will testify to the House Veterans' Affairs Committee on November 19 and Larry Ellison on December 10, over a contract ceiling that rose from about $10 billion to about $27 billion with 14 of 164 VA medical centers live. Oracle raised its restructuring plan to roughly $2.8 billion, with headcount down from about 162,000 to 141,000 and health-unit employees reporting layoffs, the week before its Health and Life Sciences Summit opens with the CMS administrator and leaders from Cleveland Clinic, Mayo, and Saudi Arabia's King Faisal Specialist Hospital on stage. The market kept moving in both directions: Oracle Health won an 11-hospital system and shipped an AI agent for nurses, while a nine-hospital New York system announced it will retire 88 applications, Oracle Health among them, on a December 2027 Epic go-live, and MEDITECH completed Expanse across 34 HCA hospitals in two full divisions, with 72 HCA hospitals converted and the next wave in October. At an industry conference, UPMC's CIO described converting 1.4 million patient records in a single weekend.
Our takeVendor turbulence is a reason to know your own numbers, whichever platform you end up on: what your current platform costs through 2028, which of your applications a conversion would retire, and how long your data migration takes when someone else's schedule is compressed. The New York system that can say "88 applications" and "lower cost by late 2028" has done the work; the systems that cannot will be making the same decision in a hurry after the December hearing.
How Purpose Health helps. Our Epic Practice brings the program management, decommissioning and migration discipline, and certified bench that carry a conversion from board decision to stable operations, for regional systems and their community affiliates. Learn about our Epic Practice →
Rural HealthRural funding started naming hospitals by the hundred
South Carolina received $167 million across 228 grants, with electronic health record modernization and cybersecurity upgrades among the named uses. Mississippi's $104 million includes $47.4 million across 97 technology-modernization grants for cybersecurity, EHR upgrades, and interoperability, plus $13.4 million across 27 telehealth and remote-monitoring grants. Connecticut's $50 million goes to four rural hospital systems for telehealth and AI-enabled monitoring. Kansas published its 14 Emerging Technology awardees, and Colorado expects to announce $200 million in awards by September 30. Washington added a new wrinkle: senators reintroduced a bill that would set mandatory minimum cybersecurity standards and fund $800 million for rural and underserved hospitals to meet them.
Our takeThe program has crossed from state awards to sub-awards, and the counts matter: 228 grants in one state and 97 technology grants in another mean dozens of small facilities holding money for EHR and security work with no implementation partner and a reporting clock already running. The hospitals that will finish on time are choosing partners now. The ones that wait will discover that everyone else in the state is calling the same three firms in the same quarter.
How Purpose Health helps. Our MEDITECH Practice specializes in rapid Expanse implementations for community and critical-access hospitals, and our program-management teams turn grant categories into delivered, reportable outcomes. Learn about our MEDITECH Practice →
IntegrationPrior authorization went live early, and the metrics for AI at scale arrived
Network Health went live on Epic's prior-authorization API ahead of the January 1, 2027 deadline to "get the bugs out," joining UnitedHealthcare, Aetna, and three health systems already live, with 16 payers in testing and about 50 pledged to handle 80% of electronic approvals in real time by 2027. At the same conference where UPMC described its weekend conversion, Mass General Brigham's chief health information officer cited a 20% reduction in clinician burnout from ambient AI and said adoption "should proceed not at the pace of availability, but at the pace of accountability," and a revenue-cycle leader described replacing twelve positions with four at similar total pay. Other systems reported 34 minutes of daily EHR time returned to primary care physicians and two million call-center interactions a year handled by agents with 58% shorter waits. CMS expanded its ACCESS Model with heart-failure, COPD, substance-use, and tobacco tracks that pay on outcomes through remote monitoring starting spring 2027.
Our take"Pace of accountability" is the right phrase, and it came from a clinician executive rather than a consultant. The evidence for AI at scale is now strong enough that the question is how to measure and govern what you deploy; the same is true of prior authorization, where your payers are going live before you are. The plumbing for both is the same: payer connectivity, data flows that feed outcomes reporting, and a governance body that can say no.
How Purpose Health helps. Our Software Development & Integrations team builds the payer connectivity and EHR data flows that prior-authorization and value-based models run on: FHIR API enablement, interface testing against payers already live, and the remote-monitoring and outcomes-reporting feeds that ACCESS-style tracks require. Learn about our Software Development & Integrations (Rosetta) →
CybersecurityThe same missing risk analysis, for the tenth time this year
OCR settled with Ambry Genetics for $700,000 over a 2020 phishing breach affecting 225,370 people, alleging no accurate risk analysis, no access-termination procedures, and no unique user IDs; it is the tenth financial penalty of 2026, and all but one resolved a risk-analysis failure. Three weeks into its incident, Luminis Health has restored phones and reopened its patient portal in read-only mode, with scheduling and messaging still down and no attribution. A Missouri critical access hospital lost its EHR and portal for about two weeks in August, diverting some emergency patients when imaging failed, and is back-entering paper records. The data stolen from McKesson contains 6.4 million unique email addresses, and a cloud practice-management vendor took eight months from intrusion to patient notification.
Our takeTen enforcement actions, nine of them about the same document. A current, accurate risk analysis that covers every location where patient data lives, hosted environments and cloud vendors included, is the least expensive control in healthcare and the one most often missing. Pair it with two things the week's outages argue for: a rehearsed downtime plan sized to the smallest hospital in your network, and contractual notification deadlines for every cloud vendor holding your data.
How Purpose Health helps. Our EHR Cloud Hosting services are built around identity and vendor-access governance, patch velocity, and rehearsed recovery, with a risk analysis that covers the hosted environment on day one. Learn about our Cybersecurity & Cloud Hosting →
The week in one paragraphThe week's stories share one condition, infrastructure under strain: agents pulling on EHR APIs at volumes nobody metered, the largest EHR programs moving under subpoenas and restructuring while conversions ran in both directions, rural money that now names hospitals by the hundred, prior authorization and AI at scale arriving with real metrics, and a tenth enforcement action about the same missing risk analysis. Every one of those is a governance question with a date on it, and the dates are close.
Purpose Health partners with health systems on Epic and MEDITECH delivery, EHR cloud hosting, software development and integration, and AI strategy, in the United States and internationally. Talk to our team about any topic in this week's Bearings.
Bearings publishes every Monday at purposehealth.ai/blog. Sources are selected for open access; no paywalled links.